Update Helm release cilium to v1.17.1

[chris-sanders]

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	1.15.10 -> 1.17.1

---

Release Notes

cilium/cilium (cilium)

v1.17.1: 1.17.1

Compare Source

Summary of Changes

Minor Changes:

• [v1.17] agent: Deprecate lb-only mode (#​37391, @​brb)
• helm: Update CiliumNodeConfig version (Backport PR #​37440, Upstream PR #​37403, @​sayboras)

Bugfixes:

• ces: Fix bug where stale endpoint information was injected into IPCache (Backport PR #​37416, Upstream PR #​37347, @​gandro)
• socket-lb: Fix null pointer dereference in socketlb/cgroup.go (Backport PR #​37440, Upstream PR #​37426, @​alvaroaleman)

CI Changes:

• test: Move the dind image to Quay to avoid rate-limiting (Backport PR #​37440, Upstream PR #​37388, @​pchaigno)

Misc Changes:

• chore(deps): update all github action dependencies (v1.17) (#​37502, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (#​37342, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.23 (v1.17) (#​37501, @​cilium-renovate[bot])
• chore(deps): update go to v1.23.6 (v1.17) (#​37446, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#​37409, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.17) (patch) (#​37496, @​cilium-renovate[bot])

Other Changes:

• install: Update image digests for v1.17.0 (#​37432, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.1@​sha256:8969bfd9c87cbea91e40665f8ebe327268c99d844ca26d7d12165de07f702866
quay.io/cilium/cilium:stable@sha256:8969bfd9c87cbea91e40665f8ebe327268c99d844ca26d7d12165de07f702866

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.1@​sha256:1de22f46bfdd638de72c2224d5223ddc3bbeacda1803cb75799beca3d4bf7a4c
quay.io/cilium/clustermesh-apiserver:stable@sha256:1de22f46bfdd638de72c2224d5223ddc3bbeacda1803cb75799beca3d4bf7a4c

docker-plugin

quay.io/cilium/docker-plugin:v1.17.1@​sha256:d4d838be1d8c20eaf1810f1be1ccc963e8229653357ec6cf8e8c1a53f3f03a71
quay.io/cilium/docker-plugin:stable@sha256:d4d838be1d8c20eaf1810f1be1ccc963e8229653357ec6cf8e8c1a53f3f03a71

hubble-relay

quay.io/cilium/hubble-relay:v1.17.1@​sha256:397e8fbb188157f744390a7b272a1dec31234e605bcbe22d8919a166d202a3dc
quay.io/cilium/hubble-relay:stable@sha256:397e8fbb188157f744390a7b272a1dec31234e605bcbe22d8919a166d202a3dc

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.1@​sha256:034b479fba340f9d98510e509c7ce1c36e8889a109d5f1c2240fcb0942bc772c
quay.io/cilium/operator-alibabacloud:stable@sha256:034b479fba340f9d98510e509c7ce1c36e8889a109d5f1c2240fcb0942bc772c

operator-aws

quay.io/cilium/operator-aws:v1.17.1@​sha256:da74748057c836471bfdc0e65bb29ba0edb82916ec4b99f6a4f002b2fcc849d6
quay.io/cilium/operator-aws:stable@sha256:da74748057c836471bfdc0e65bb29ba0edb82916ec4b99f6a4f002b2fcc849d6

operator-azure

quay.io/cilium/operator-azure:v1.17.1@​sha256:b9e3e3994f5fcf1832e1f344f3b3b544832851b1990f124b2c2c68e3ffe04a9b
quay.io/cilium/operator-azure:stable@sha256:b9e3e3994f5fcf1832e1f344f3b3b544832851b1990f124b2c2c68e3ffe04a9b

operator-generic

quay.io/cilium/operator-generic:v1.17.1@​sha256:628becaeb3e4742a1c36c4897721092375891b58bae2bfcae48bbf4420aaee97
quay.io/cilium/operator-generic:stable@sha256:628becaeb3e4742a1c36c4897721092375891b58bae2bfcae48bbf4420aaee97

operator

quay.io/cilium/operator:v1.17.1@​sha256:5c5f4408112365ae10ebcbab2621c273cebc671fe63b0f19cc1376326f140f89
quay.io/cilium/operator:stable@sha256:5c5f4408112365ae10ebcbab2621c273cebc671fe63b0f19cc1376326f140f89

v1.17.0: 1.17.0

Compare Source

We are excited to announce the Cilium 1.17.0 release!

A total of 2761 new commits have been contributed to this release by a growing community of over 880 developers and over 20,800 GitHub stars! 🤩

To keep up to date with all the latest Cilium releases, see Announcements

Here's what's new in v1.17.0:

🚠 Networking

• 🚦 Quality of Service: Annotate your Pods for Guaranteed, Burstable or BestEffort egress network traffic priority (#​36025, @​hemanthmalla)
• 🌐 Multi-Cluster Service API: Use Kubernetes MCS to manage global services in a Cilium Cluster Mesh (#​34439, @​MrFreezeex)
• 🔀 Load Balance based on L4 Protocol: Differentiate TCP and UDP based protocols for load balancing, so multiple services on the same port can be directed to different backends (#​33434, @​jibi)
• 🧲 Per-Service LB Algorithms: Choose maglev or random load balancing algorithms for individual services (#​35735, @​kl52752)
• ⛔ Deny lists for Service source ranges: Control whether Kubernetes loadBalancerSourceRanges are treated as an allow or deny list (#​36120, @​borkmann)
• 🏊 Better control over IPAM: IPs can be allocated statically using AWS tags, and multi-pool can support single IP ranges for pools (#​34622, @​antonipp; #​34618, @​juliusmh)
• 🔌 Dynamic MTU detection: Cilium respects changes made to MTU made at runtime without requiring agent restart (#​34314, @​dylandreimerink)

💂‍♀️ Security

• 🚀 Improved network policy performance: The cost of computing complex combinations of network policies has been reduced (Various PRs by @​joamaki, @​jrajahalme, @​marseel, @​nathanjsweet, @​squeed and @​youngnick)
• 🗂️ Prioritize critical network policies: Cilium respects Kubernetes priorityNamespaces to prioritize endpoint propagation for critical namespaces when using CiliumEndpointSlices (#​34199, @​Kaczyniec)
• 📋 Validate Network Policies: Receive better feedback from Kubernetes when creating network policies (#​34585, @​squeed; #​35904, @​renyunkang; #​36598, @​pippolo84)
• 🏷️ Select CIDRGroups by Label: Add labels to CIDRGroups and use these for network policy selection (#​36087, @​squeed)
• 🛎️ Extend ToServices for in-cluster services: Services with a selector can be selected with ToServices network policies statements (#​34208, @​chaunceyjiang)
• 🚧 FQDN Filtering for hostNetwork: Use CiliumClusterwideNetworkPolicy to configure Layer 7 filtering for DNS requests on nodes in the cluster (#​34024, @​atykhyy)
• 📶 HTTP policies on port ranges: Redirect multiple ports in a single policy towards Envoy for Layer 7 filtering of HTTP traffic (#​36056, @​jrajahalme)

🕸️ Service Mesh & Gateway API

• ⛩️ Gateway API 1.2.1: Add support for the latest Gateway API v1.2.1 release, including HTTP retries and mirror fractions (#​34720, @​sayboras)
• 📝 Static Gateway Addressing: Cilium now supports statically specifying addresses for gateways (#​33042, @​chaunceyjiang)
• 🔐 Improved Envoy TLS handling: Use SDS for managing TLS visibility secrets in Envoy, improving policy calculation speed and secrets access (#​35513, @​youngnick)

🛰️ Observability

• 🔍 Dynamic Hubble Metrics: Configure Hubble metrics with a new hubble-metrics-config ConfigMap to tune your network observability (#​35185, @​rectified95)
• 🛤️ Track enabled features using Prometheus: The cilium-agent and cilium-operator components expose Prometheus metrics for which features are enabled. (#​35852, @​aanm)
• 📊 Many new metrics: Improved metrics related to BGP, network connections, network policy, pod management, and Cilium component status (Various PRs by @​AwesomePatrol, @​harsimran-pabla, @​joestringer, @​jshr-w, @​mikejoh, @​nimishamehta5, @​odinuge, @​ovidiutirla, @​rectified95 and @​sjdot)

🌅 Scale

• 📈 Better cluster connectivity checking: The cilium-health component for cluster-wide network connectivity health detection is better tuned for reliable health checking at high scale (#​35163, @​jshr-w)
• ⏳ Rate-limit monitor events: Balance the number of eBPF events against the CPU usage required to process them (#​29711, @​siwiutki)
• 👥 Double-Write Identity mode: New allocation mode for Security Identities to ease migration between CRD and KVStore identity backends (#​31920, @​antonipp)
• ⚖️ Better scale testing: This release benefits from regular automated scale testing for network policy (#​35278, @​marseel)

🏘️ Community

• ❤️ Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback!
  • Seznam, Alibaba Cloud, SysEleven, QingCloud, ECCO, Reddit, Confluent, SamsungAds, and Sony
• The Cilium Annual Report 2024 was released covering all the highlights from across the community and marking the “Year of Kubernetes Networking”
• The community gathered at Cilium + eBPF Day and the Cilium Developer Summit in Salt Lake City
• Meet us at the upcoming CiliumCon and the Cilium Developer Summit in London

And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ ❤️ ❤️

For the full changelog check https://github.com/cilium/cilium/blob/v1.17.0/CHANGELOG.md

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.0@​sha256:51f21bdd003c3975b5aaaf41bd21aee23cc08f44efaa27effc91c621bc9d8b1d
quay.io/cilium/cilium:stable@sha256:51f21bdd003c3975b5aaaf41bd21aee23cc08f44efaa27effc91c621bc9d8b1d

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.0@​sha256:05ccf79102724a943b967337a7cd45177118b76b72fb937d0c8ecb3ce136605c
quay.io/cilium/clustermesh-apiserver:stable@sha256:05ccf79102724a943b967337a7cd45177118b76b72fb937d0c8ecb3ce136605c

docker-plugin

quay.io/cilium/docker-plugin:v1.17.0@​sha256:cf2a7b6779e1264c35d77a799aab25ee9bb67582764b297edf6ad62fa02a3c6f
quay.io/cilium/docker-plugin:stable@sha256:cf2a7b6779e1264c35d77a799aab25ee9bb67582764b297edf6ad62fa02a3c6f

hubble-relay

quay.io/cilium/hubble-relay:v1.17.0@​sha256:022c084588caad91108ac73e04340709926ea7fe12af95f57fcb794b68472e05
quay.io/cilium/hubble-relay:stable@sha256:022c084588caad91108ac73e04340709926ea7fe12af95f57fcb794b68472e05

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.0@​sha256:0154a855650dac844347d35404e08f3ad141c05e1d903a648558e6f15e4fef8b
quay.io/cilium/operator-alibabacloud:stable@sha256:0154a855650dac844347d35404e08f3ad141c05e1d903a648558e6f15e4fef8b

operator-aws

quay.io/cilium/operator-aws:v1.17.0@​sha256:a81cea10c4210589750c2588a20ece2822fd57be8529df4dc7779031cec66af7
quay.io/cilium/operator-aws:stable@sha256:a81cea10c4210589750c2588a20ece2822fd57be8529df4dc7779031cec66af7

operator-azure

quay.io/cilium/operator-azure:v1.17.0@​sha256:56e83fbdfbea161b2252c51c7ce03960f7141700473bbd2906bcdb53f46610d7
quay.io/cilium/operator-azure:stable@sha256:56e83fbdfbea161b2252c51c7ce03960f7141700473bbd2906bcdb53f46610d7

operator-generic

quay.io/cilium/operator-generic:v1.17.0@​sha256:1ce5a5a287166fc70b6a5ced3990aaa442496242d1d4930b5a3125e44cccdca8
quay.io/cilium/operator-generic:stable@sha256:1ce5a5a287166fc70b6a5ced3990aaa442496242d1d4930b5a3125e44cccdca8

operator

quay.io/cilium/operator:v1.17.0@​sha256:39c9221d75f47f717fe438912309a96b59b8257a74dc624fdeebebcfbd74b587
quay.io/cilium/operator:stable@sha256:39c9221d75f47f717fe438912309a96b59b8257a74dc624fdeebebcfbd74b587

v1.16.7: 1.16.7

Compare Source

Summary of Changes

Minor Changes:

• Add IngressDeny and EgressDeny rules validation for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy (Backport PR #​37124, Upstream PR #​36598, @​pippolo84)
• doc: Added hostLegacyRouting limitation for Talos (Backport PR #​37168, Upstream PR #​36852, @​PhilipSchmid)

Bugfixes:

• agent: defend against null pointer refs in cecManager.getEndpoint() (Backport PR #​37375, Upstream PR #​37188, @​aetimmes)
• Allow cilium agent to start on linux kernels that don't have CONFIG_XFRM. (Backport PR #​37278, Upstream PR #​37123, @​julianwiedmann)
• ces: Fix bug where stale endpoint information was injected into IPCache (Backport PR #​37417, Upstream PR #​37347, @​gandro)
• envoy: add configurable access log buffer size (Backport PR #​37168, Upstream PR #​36823, @​aetimmes)
• Fix a bug that prevents a pod from accessing Nodeport services when the pod is also in scope of a broad-range Egress Gateway policy. (Backport PR #​37168, Upstream PR #​36929, @​julianwiedmann)
• Fix bug causing the endpoint regeneration failure handler to be effective only once (Backport PR #​37278, Upstream PR #​37085, @​giorio94)
• Fix bug potentially causing newly added endpoints to remain stuck in waiting-to-regenerate state forever, causing traffic from/to that endpoint to be incorrectly dropped. (Backport PR #​37168, Upstream PR #​37086, @​giorio94)
• Fix specifying multiple interfaces for egress masquerade with enable-masquerade-to-route-source=false (Backport PR #​37168, Upstream PR #​36103, @​viktor-kurchenko)
• maps/nat/stats: Use Start context when waiting for maps (Backport PR #​37278, Upstream PR #​37262, @​tommyp1ckles)
• nodeinit: move kubelet restart inside if/else in startup.bash (Backport PR #​37375, Upstream PR #​37282, @​ayuspin)
• Restore the original flag semantics for --egress-masquerade-interfaces to the same as v1.17.0-pre.2 or earlier (Backport PR #​37168, Upstream PR #​36504, @​viktor-kurchenko)
• socket-lb: Fix null pointer dereference in socketlb/cgroup.go (Backport PR #​37441, Upstream PR #​37426, @​alvaroaleman)

CI Changes:

• [v1.16] ctmap/gc: don't clamp conntrack scan timeout in CI (#​37380, @​giorio94)
• gh: harmonize lvh kernel naming scheme (Backport PR #​37375, Upstream PR #​37322, @​julianwiedmann)
• gh: update removed --loglevel option for kind (Backport PR #​37168, Upstream PR #​36935, @​julianwiedmann)
• gha: bump ubuntu version in conformance-externalworkloads (Backport PR #​37168, Upstream PR #​36859, @​giorio94)
• gha: correctly downgrade to patch release in ipsec workflows (Backport PR #​37168, Upstream PR #​36858, @​giorio94)
• gha: fix retrieval of DNS server in conformance external workloads (Backport PR #​37375, Upstream PR #​37361, @​giorio94)
• gha: Retrieve eks supported version via aws cli (Backport PR #​37223, Upstream PR #​37210, @​sayboras)
• Modify bpftrace script in CI to ignore proxy traffic if destination is outside pod CIDRs. (Backport PR #​37168, Upstream PR #​36364, @​smagnani96)
• Skip tracking unmarked plain-text TCP RST packets generated from proxy timeouts in the CI bpftrace script. (Backport PR #​37168, Upstream PR #​36962, @​smagnani96)
• test: Fix the flake for TestRestoredPort (Backport PR #​37278, Upstream PR #​37106, @​sayboras)
• test: Move demo-httpd from Docker to Quay (Backport PR #​37278, Upstream PR #​37149, @​joestringer)
• test: Move the dind image to Quay to avoid rate-limiting (Backport PR #​37441, Upstream PR #​37388, @​pchaigno)

Misc Changes:

• build: Remove debug leftover from Makefile (Backport PR #​37168, Upstream PR #​36917, @​gentoo-root)
• chore(deps): update actions/setup-go action to v5.3.0 (v1.16) (#​37117, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​37244, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​37505, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​37343, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​37550, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.24 (v1.16) (#​37338, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.20 (v1.16) (#​37215, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.23 (v1.16) (#​37503, @​cilium-renovate[bot])
• chore(deps): update go to v1.23.6 (v1.16) (#​37497, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.31.5-1737535524-fe8efeb16a7d233bffd05af9ea53599340d3f18e (v1.16) (#​37201, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​37411, @​cilium-renovate[bot])
• cilium-dbg/troubleshoot: do not import cilium-dbg from operator (Backport PR #​37375, Upstream PR #​37326, @​aanm)
• clustermesh: Add hidden flag --allow-unsafe-policy-skb-usage (Backport PR #​37168, Upstream PR #​36602, @​joestringer)
• doc(glossary): Geneve as final RFC (Backport PR #​37375, Upstream PR #​37316, @​alagoutte)
• doc: ebpf host-routing and netfilter (Backport PR #​37168, Upstream PR #​36921, @​PhilipSchmid)
• doc: eks cluster restriction removed (Backport PR #​37278, Upstream PR #​37043, @​viktor-kurchenko)
• doc: Removed nodeinit from aks byocni install (Backport PR #​37168, Upstream PR #​37048, @​PhilipSchmid)
• docs: Add SNI policy example (Backport PR #​37375, Upstream PR #​37234, @​sayboras)
• docs: Clarify Identity-Relevant Labels description (Backport PR #​37168, Upstream PR #​36924, @​joestringer)
• docs: Fix broken link in BGP control plane docs (Backport PR #​37375, Upstream PR #​37241, @​mikejoh)
• docs: pass current_version to html_context (Backport PR #​37168, Upstream PR #​37008, @​ayuspin)
• docs: Remove stale limitation on KPR+IPsec (Backport PR #​37168, Upstream PR #​37054, @​pchaigno)
• images: don't assume Dockerfile directory in builder/runtime update scripts (Backport PR #​37375, Upstream PR #​34488, @​tklauser)
• proxy: Mark restored port as configured (Backport PR #​37168, Upstream PR #​36953, @​jrajahalme)
• Remove outdated roadmap matrix and links to it (Backport PR #​37278, Upstream PR #​37170, @​xmulligan)
• remove stable tags from image build (#​37394, @​aanm)
• renovate: add fix grpc-go autodetection (Backport PR #​37278, Upstream PR #​33570, @​aanm)

Other Changes:

• [v1.16] envoy: Bump envoy version to v1.31.x (#​37157, @​sayboras)
• chore(deps): update go to v1.23.5 (v1.16) (#​37189, @​sayboras)
• Do not leak ipcache entries when apiserver entities are cluster external (#​36927, @​antonipp)
• install: Update image digests for v1.16.6 (#​37154, @​cilium-release-bot[bot])
• Revert "chore(deps): update all-dependencies (v1.16)" (#​37525, @​sayboras)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.7@​sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.7@​sha256:8e7eda5b194d45c3b1607f5bf31cbb3fecd0f1cf85ce32b41f93b2bd832bf02f

docker-plugin

quay.io/cilium/docker-plugin:v1.16.7@​sha256:d5c331e03a7c9f158e43eef46537a7656b668dcf76e7b8397520770a51747803

hubble-relay

quay.io/cilium/hubble-relay:v1.16.7@​sha256:8f408ed921cd534394aa1c57b313741cec6aec03a14ea243b2173cbf2c88c91e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.7@​sha256:dbdc856303e1ab6734538e29791fdfc4fe2c1295fd7bbce8fa006cd3165f85c8

operator-aws

quay.io/cilium/operator-aws:v1.16.7@​sha256:110d922337bdbfc3cd4d7d71b85b2c8f72c1d9925e9b61b4cd73ff990799d7ba

operator-azure

quay.io/cilium/operator-azure:v1.16.7@​sha256:4e7e64cc505676d402c68043934e2c8efc75b294245514d7611a58d06b5e0f69

operator-generic

quay.io/cilium/operator-generic:v1.16.7@​sha256:25a41ac50bcebfb780ed2970e55a5ba1a5f26996850ed5a694dc69b312e0b5a0

operator

quay.io/cilium/operator:v1.16.7@​sha256:bac2496ba4348267ca5f16c2dd73ba7be76330cdd0eef0a6958c260a3bf5951d

v1.16.6: 1.16.6

Compare Source

Summary of Changes

Major Changes:

• Add feature tracking in Cilium agent as prometheus metrics (Backport PR #​36263, Upstream PR #​35852, @​aanm)
• Add feature tracking in Cilium Operator as prometheus metrics (Backport PR #​36263, Upstream PR #​36077, @​aanm)

Minor Changes:

• envoy: Use yaml format for bootstrap config (Backport PR #​36782, Upstream PR #​36820, @​sayboras)
• Reject CNP/CCNP with CIDR rules where CIDRGroupRef is used in combination with ExceptCIDRs (#​36561, @​pippolo84)
• service: Cap number of backends included in monitor message (Backport PR #​36635, Upstream PR #​36394, @​joamaki)

Bugfixes:

• cilium: LB source ranges fixes (Backport PR #​36635, Upstream PR #​36517, @​borkmann)
• eni.subnetTagsFilter and eni.instanceTagsFilter are now templated to comma separated string (Backport PR #​36872, Upstream PR #​36617, @​sderoe)
• envoy: Configure internal address config based on IP family (Backport PR #​36782, Upstream PR #​36733, @​sayboras)
• Fix connectivity issue caused by stale cilium eBPF program when using --bpf-filter-priority (Backport PR #​36635, Upstream PR #​36176, @​tamilmani1989)
• metrics/features: remove reporting metrics' defaults by default (Backport PR #​36263, Upstream PR #​36298, @​aanm)
• pkg/redirectpolicy: Fix backend slices in processConfig (Backport PR #​36872, Upstream PR #​35496, @​Sm0ckingBird)
• ui: drop CORS headers from api response (Backport PR #​36872, Upstream PR #​35762, @​geakstr)

CI Changes:

• [v1.16] .github: Remove CI Fuzz workflow (#​36641, @​joestringer)
• [v1.16] gh: e2e-upgrade: use 6.12 kernel for netkit test configs (#​36620, @​julianwiedmann)
• [v1.16] gha: use /test to trigger tests in stable branches (#​36673, @​giorio94)
• ci: fix job names for various ci workflows (Backport PR #​36263, Upstream PR #​36397, @​marseel)
• Extend the check-ipsec-leak bpftrace script to capture additional details of leaked packets (Backport PR #​36872, Upstream PR #​33398, @​giorio94)
• gh: e2e-upgrade: add coverage for 6.6 kernel (Backport PR #​36988, Upstream PR #​36626, @​julianwiedmann)
• gh: e2e-upgrade: de-renovate the config example (Backport PR #​36635, Upstream PR #​36463, @​julianwiedmann)
• gha: drop leftover token parameter in net-perf-gke workflow (#​36684, @​giorio94)
• gha: fix merging of features-related artifacts (#​36665, @​giorio94)
• gha: merge artifacts in net-perf-gke workflow (Backport PR #​36263, Upstream PR #​36236, @​giorio94)
• gha: Use ubuntu-24.04 for integration-test (Backport PR #​36659, Upstream PR #​36628, @​sayboras)

Misc Changes:

• .github/workflows: always install cilium-cli (Backport PR #​36263, Upstream PR #​36234, @​aanm)
• .github/workflows: do not fail ginkgo if unable to fetch features (Backport PR #​36263, Upstream PR #​36461, @​aanm)
• .github: fix conformance-k8s NP test (Backport PR #​36263, Upstream PR #​36355, @​aanm)
• [v1.16] Use bash syntax to consume env variable (#​36636, @​ferozsalam)
• Add more features tracking in Cilium agent as prometheus metrics (Backport PR #​36263, Upstream PR #​36078, @​aanm)
• Add policy-related features tracking in Cilium agent as prometheus metrics (Backport PR #​36263, Upstream PR #​36203, @​aanm)
• Add the tls:// prefix in the Hubble TLS doc (Backport PR #​36635, Upstream PR #​36410, @​liyihuang)
• chore(deps): update all github action dependencies (v1.16) (#​36612, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​36762, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​36950, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (#​37099, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.16) (patch) (#​36760, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​36707, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​36787, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​36949, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.16) (#​37033, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.23 (v1.16) (#​36895, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.36.1 docker digest to 7c3c3ce (v1.16) (#​36609, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.10 docker digest to 1a6e657 (v1.16) (#​36850, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.22.10 docker digest to 9855006 (v1.16) (#​36610, @​cilium-renovate[bot])
• chore(deps): update go to v1.22.11 (v1.16) (#​37045, @​cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.12.0 (v1.16) (#​36839, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​36611, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.16) (patch) (#​36699, @​cilium-renovate[bot])
• doc: fix typo on kubeproxy-free (CEV -> CVE) (Backport PR #​36872, Upstream PR #​36701, @​alagoutte)
• docs: Add missing default identity label in the description of identity-relevant labels' example (Backport PR #​36635, Upstream PR #​36558, @​liyihuang)
• docs: Clarify the behavior of CiliumNetworkPolicies toCIDRSet (Backport PR #​36635, Upstream PR #​36549, @​verysonglaa)
• Ensure debug symbols are generated for the debug image even when stripping symbols for the release image. (Backport PR #​36635, Upstream PR #​36417, @​EricMountain)
• Fix make -C Documentation update-cmdref when make uses --jobserver-style=fifo. (Backport PR #​36872, Upstream PR #​36788, @​gentoo-root)
• fix(deps): update module golang.org/x/net to v0.33.0 [security] (v1.16) (#​36711, @​cilium-renovate[bot])
• ingress, gateway-api: Convert test fixtures to file based (Backport PR #​36782, Upstream PR #​36732, @​sayboras)
• metrics/features: enable ClusterMesh (Backport PR #​36263, Upstream PR #​36402, @​aanm)
• metrics/features: refactor metric names (Backport PR #​36263, Upstream PR #​36209, @​aanm)
• Prepare for release v1.16.6 (#​36989, @​cilium-release-bot[bot])
• Remove reference to DNS polling (Backport PR #​36872, Upstream PR #​36679, @​JacobHenner)

Other Changes:

• [v1.16] author backport: helm: avoid setting bpf-lb-sock-terminate-pod-connections (#​36650, @​ysksuzuki)
• install: Update image digests for v1.16.5 (#​36671, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.6@​sha256:1e0896b1c4c188b4812c7e0bed7ec3f5631388ca88325c1391a0ef9172c448da
quay.io/cilium/cilium:stable@sha256:1e0896b1c4c188b4812c7e0bed7ec3f5631388ca88325c1391a0ef9172c448da

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.6@​sha256:ab2070ea48a52a55d961b81b7b5fbac7d40a3f428be9b1b6b9071d47f194456a
quay.io/cilium/clustermesh-apiserver:stable@sha256:ab2070ea48a52a55d961b81b7b5fbac7d40a3f428be9b1b6b9071d47f194456a

docker-plugin

quay.io/cilium/docker-plugin:v1.16.6@​sha256:f8f5833a60900b0264fd8982b11329e130c1a326afe2e4653e9f2d2e3fb2af66
quay.io/cilium/docker-plugin:stable@sha256:f8f5833a60900b0264fd8982b11329e130c1a326afe2e4653e9f2d2e3fb2af66

hubble-relay

quay.io/cilium/hubble-relay:v1.16.6@​sha256:ca8dcaa5a81a37743b1397ba2221d16d5d63e4a47607584f1bf50a3b0882bf3b
quay.io/cilium/hubble-relay:stable@sha256:ca8dcaa5a81a37743b1397ba2221d16d5d63e4a47607584f1bf50a3b0882bf3b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.6@​sha256:0e3c7fbcb6bde9a247cd2dd3d25230e2859d40d2eb58aba6265a2aab216775a9
quay.io/cilium/operator-alibabacloud:stable@sha256:0e3c7fbcb6bde9a247cd2dd3d25230e2859d40d2eb58aba6265a2aab216775a9

operator-aws

quay.io/cilium/operator-aws:v1.16.6@​sha256:d11ee1cfa3465defe2df7ec1c6e8a77bcaf280b44d2c61aa7496c58b29550f6d
quay.io/cilium/operator-aws:stable@sha256:d11ee1cfa3465defe2df7ec1c6e8a77bcaf280b44d2c61aa7496c58b29550f6d

operator-azure

quay.io/cilium/operator-azure:v1.16.6@​sha256:0a05d7aea760923897aabd715213ab11a706051673d41fab3874a37f897c1bdd
quay.io/cilium/operator-azure:stable@sha256:0a05d7aea760923897aabd715213ab11a706051673d41fab3874a37f897c1bdd

operator-generic

quay.io/cilium/operator-generic:v1.16.6@​sha256:13d32071d5a52c069fb7c35959a56009c6914439adc73e99e098917646d154fc
quay.io/cilium/operator-generic:stable@sha256:13d32071d5a52c069fb7c35959a56009c6914439adc73e99e098917646d154fc

operator

quay.io/cilium/operator:v1.16.6@​sha256:09ab2878e103fa32a00fd1fe4469f7042cfb053627b44c82fa03a04a820c0b46
quay.io/cilium/operator:stable@sha256:09ab2878e103fa32a00fd1fe4469f7042cfb053627b44c82fa03a04a820c0b46

v1.16.5: 1.16.5

Compare Source

Summary of Changes

Minor Changes:

• hubble: Stop building 32-bit binaries (Backport PR #​36066, Upstream PR #​35974, @​michi-covalent)

Bugfixes:

• Address potential connectivity disruption when using either L7 / DNS Network policies in combination with per-endpoint routes and hostLegacyRouting, or L7 / DNS network policies in combination with IPsec network encryption. (Backport PR #​36540, Upstream PR #​36484, @​julianwiedmann)
• bgp: fix race in bgp stores (Backport PR #​36066, Upstream PR #​35971, @​harsimran-pabla)
• BGPv1: Fix race by reconciliation of services with externalTrafficPolicy=Local by populating locally available services after performing service diff (Backport PR #​36286, Upstream PR #​36230, @​rastislavs)
• BGPv2: Fix race by reconciliation of services with externalTrafficPolicy=Local by populating locally available services after performing service diff (Backport PR #​36286, Upstream PR #​36165, @​rastislavs)
• Cilium agent now waits until endpoints have restored before starting accepting new xDS streams. (Backport PR #​36049, Upstream PR #​35984, @​jrajahalme)
• Cilium no longer keeps old DNS-IP mappings alive while reaping newer ones, leading to spurious drops in connections to domains with many IPs associated. (Backport PR #​36462, Upstream PR #​36252, @​bimmlerd)
• cilium-health-ep controller is made to be more robust against successive failures. (Backport PR #​36066, Upstream PR #​35936, @​jrajahalme)
• DNS proxy port is no longer released when endpoint with a DNS policy fails to regenerate successfully. A potential deadlock between CEC/CCEC parser and endpoint policy update is removed. (Backport PR #​36468, Upstream PR #​36142, @​jrajahalme)
• Envoy "initial fetch timeout" warnings are now demoted to info level, as they are expected to happen during Cilium Agent restart. (Backport PR #​36049, Upstream PR #​36060, @​jrajahalme)
• Fix an issue where pod-to-world traffic goes up stack when BPF host routing is enabled with tunnel. (Backport PR #​35861, Upstream PR #​35098, @​jschwinger233)
• Fix identity leak for kvstore identity mode (Backport PR #​36066, Upstream PR #​34893, @​odinuge)
• Fix potential Cilium agent panic during endpoint restoration, occurring if the corresponding pod gets deleted while the agent is restarting. This regression only affects Cilium v1.16.4. (Backport PR #​36302, Upstream PR #​36292, @​giorio94)
• gateway-api: Fix gateway checks for namespace (Backport PR #​36462, Upstream PR [#​35452](https://github.com/cilium/cilium/issu

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.